Remarks 

[0010] Applicant respectfully requests reconsideration and allowance of all of the 
claims of the application. The status of the claims is as follows: 

• Claims 1 , 6-8, 1 3-21 , and 23-29 are currently pending; 

• Claims 2-5, 9-1 2 , 22 and 30 are canceled; 

• Claims 1 and 13 are currently amended; 

• Claims 14 and 21 are previously presented; and 

• Claims 6-8, 1 5-20 and 23-29 are original. 

Claims 1. 14 and 21 Comply With §112 2nd Paragraph 

[0011] Claims 1, 14 and 21 stand rejected under 35 U.S.C. § 112, H 2, as allegedly 

being indefinite. The Applicant, for the sole purpose of expediting prosecution and 
without acquiescing in the propriety of the Office's rejections, herein amends claim 1 as 
shown above. The amendment recites that the parsing continues until file format 
recognition "or until all available component parsers within the compound parser have 
parsed the input file". Accordingly, it is possible to not recognize a file format or type, 
and to have a "don't know" status. Applicant respectfully submits that this amendment 
renders the § 11 2 rejections moot. 

[0012] Claim 14 does not recite "continuing to parse ... until recognized". 
Accordingly, claim 16 would appear to not have the problem indicated. If this rejection 
is maintained, the Applicant requests further clarification. 
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[0013] Similarly, claim 21 does not recite "continuing to parse ... until recognized"; 
accordingly, claim 21 would not appear to have the problem indicated. If this rejection is 
maintained, the Applicant requests further clarification. 

Overview of the Application 

[0014] The Application describes parsing a file to recognize a file format repeatedly 
with component parsers within a compound parser. In one aspect of the application, the 
search for virus code is based in part on discovering a file format for the input file . The 
file format could be PDF, doc (Word), ioeq. vsd (Visio) or others (see Applicant's 
paragraph r00171 and numerous other locations) . Each component parser within the 
compound parser is configured to recognize a file format of an input file. If recognized, 
the component parser is configured to detect viruses within the environment of the 
recognized file format. The compound parser continues to parse, repeatedly applying a 
sequence of component parsers, until the file format is recognized or all available 
component parsers are used. A status report could be sent. For example, if the file 
format was recognized (e.g. PDF) then virus code was either found or not found by the 
component parser within the compound parser associated with the PDF format. 
Alternatively, if no component parser within the compound parser was able to recognize 
the format of the input file, then a "don't know" could be sent as status. 

Cited Documents 

[0015] The following documents have been applied to reject one or more claims of 

the Application: 

• Chen, US 5,960,170. 
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Overview of Chen. US 5.960.170 

[0016] Chen, US 5,960,170, describes event triggered iterative virus detection, 
wherein a plurality of virus detection objects are produced, such as virus detection 
objects tailored for different file types (column 1 1 , lines 35-45) or virus detection objects 
that are based on known virus signature (column 1 1 , line 45) or based on violation of 
different rules, such as inclusion of suspect command sequences (column 11, lines 45- 
48). 

[0017] Significantly, Chen discloses that virus detection objects are configured for 
different virus types, which may reside in different file types. Thus, Chen discloses 
transmission of virus detection objects configured to detect different types of viruses in 
some file type (e.g. executable files, as in column 11, lines 37-40). However, Chen 
does not disclose that the virus detection objects parse "an input file to recognize a file 
format of the input file" and that the virus detection modules are each "configured for 
recognition of a specific file format by which an input file is configured" (emphasis 
added). 

[0018] Looked at another way, Chen discloses that the virus types can be divided up 
into groups, and that virus detection modules can be configured to attack each type. 
For example, virus detection modules can attack viruses that are adapted for hiding in 
executable files or Word files, viruses with known signatures and viruses that violate a 
set of rules (see Chen at column 1 1 , lines 22-51 ). 

[0019] However, nothing in Chen discloses that virus detection modules "parse an 
input file to recognize a file format of the input file". Chen appears to assume that the 
file format of a given file is known, or that having the extension "exe" somehow 
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guarantees that the file is an executable file. Chen fails to disclose parsing the file to 
recognize the file format of the input file. 

Chen Fails to Anticipate Claims 1. 14 and 21 

[0020] Claims 1, 14 and 21 stand rejected under 35 U.S.C. § 102(b) as allegedly 
being anticipated by Chen. Applicant respectfully traverses the rejection. 

Independent Claim 1 

[0021] The Applicant submits that the Chen reference does not show or disclose at 
least the following features as recited in Claim 1 as presently amended (with emphasis 
added): 

• "parsing an input file to recognize a file format of the input file" 

[0022] The Applicant respectfully submits that Chen does not show or disclose 
parsing an input file to recognize a file format of the input file. The Office points to 
column 11, where Chen discloses iterative production and transmission of virus 
detection modules (column 11, lines 22-23). 

[0023] Referring to column 11, the modules are tailored to look at specific file types 
such as exe or doc (column 11, lines 37-43) or to look for certain signature viruses 
(column 11, line 45) or to look for suspicious data that appears to be virus like due to 
"rule" of what viruses may do (column 11, lines 45-48). However, the Applicant 
respectfully maintains that Chen does not show or disclose "parsing an input file to 
recognize a file format of the input file", as recited by the claim. Thus, the Applicant 
respectfully submits that Chen fails to show or disclose parsing an input file to recognize 
a file format of the input file . Such parsing would reveal, for example, if the input file is a 
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PDF or a jpeg. This is not a concern of Chen, and is not disclosed by Chen. 
Accordingly, Chen does not disclose "parsing an input file to recognize a file format of 
the input file". 

[0024] The Applicant submits that the Chen reference does not show or disclose at 
least the following features as recited in Claim 1 as presently amended (with emphasis 
added): 

• "wherein each of the plurality of component parsers is configured for 
recognition of a specific file format by which an input file is configured" 

[0025] The Applicant's claim recites "recognition of a specific file format". The Office 
cited column 11, suggesting that the virus detection modules taught by Chen 
recognized file formats. The Applicant respectfully submits that Chen discloses that 
virus detection modules detect viruses on different types of files (exe or doc, for 
example), but Chen does not disclose that the virus detection modules actually 
recognize different file formats. That is, Chen discloses that: 

[0026] "Similarly, routines for the detection of viruses that reside in "executable" 
files (such as those that have the file extension .exe) are provided such that they can be 
accessed separate from routines used for the detection of macro viruses (such as those 
that implement the WordBasic programming language, typically reside in application 
data files, and include extensions such as .doc or .dot)." 
[0027] Accordingly, Chen discloses routines for detection of viruses in different file 
types, but the Applicant respectfully submits that Chen fails to show or disclose 
component parsers "configured for recognition of a specific file format by which an input 
file is configured ". Thus, Chen's routines detect viruses in exe of doc files, but Chen 

Serial No.: 10/769,106 -lo , ^, ^ . 

/IS1-1903US leepha^ The Business of IP* 

www.leehayes.com » 509.324.9256 



does not disclose component parsers is configured for recognition of a specific file 
format (e.g. PDF or exe) by which an input file is configured. 

[0028] The Applicant submits that the Chen reference does not show or disclose at 
least the following features as recited in Claim 1 as presently amended (with emphasis 
added): 

• "adding an additional component parser configured to recognize an 
additional file format and executable code if present in a file of the 
additional file format" 

[0029] The Applicant respectfully submits that Chen does not show or disclose 
"adding an additional component parser configured to recognize an additional file 
format". The Applicant has amended Claim 1 to additionally recite that additional 
component parsers are "configured to recognize an additional file format". As discussed 
above, Chen does not show or disclose the concept of "recognizing additional file 
formats". Chen does disclose different virus detectors for different file formats (column 
1 1 , lines 35-45), but does not show or disclose "adding an additional component parser 
configured to recognize an additional file format". 

[0030] The Applicant submits that the Chen reference does not show or disclose at 
least the following features as recited in Claim 1 as presently amended (with emphasis 
added): 

• "continuing to parse the input file until a component parser recognizes 
the file format of the input file" 
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[0031] The Applicant's claim 1 recites "continuing to parse the input file until a 
component parser recognizes the file format of the input file". The Office points to 
column 13, lines 38-55 of Chen. However, at indicated passage in Chen discloses only 
that a repeated, iterative process is undertaken to discover if a virus exists. This is 
completely different than parsing to find the input file format . The Applicant's recited 
"continuing to parse the input file until a component parser recognizes the file format of 
the input file", could result in determination that the file was a jpeg or a PDF. In 
contrast, Chen discloses (at column 13, lines 38-55) that scanning the input file can 
reveal virus signatures (strings of suspicious data) within the input file. 
[0032] The Applicant submits that the combination of cited art does not teach or 
suggest at least the following features as recited in Claim 1 as presently amended (with 
emphasis added): 

• '"sending a don't-know status when the file format of the input file was 
not recognized" 

[0033] The Applicant's claim 1 recites "sending a don't-know status when the file 
format of the input file was not recognized". The Office points (see rejection of Claims 
16, 22) to column 8, lines 17-24. However, in this passage, Chen fails to disclose (1) 
the "don't know status" and (2) tying the "don't know status" to failure to recognize a file 
format. Again, Chen has different approach to virus detection, which does not involve 
parsing to recognize a file format. 

[0034] The Applicant submits that the combination of cited art does not teach or 
suggest at least the following features as recited in Claim 1 as presently amended (with 
emphasis added): 
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• "wherein adding an additional component parser comprises instructions 
for identifying a new file format" 

[0035] The Applicant has amended claim 1 to recite elements previously seen in 
dependent claim 30, "wherein adding an additional component parser comprises 
instructions for identifying a new file format". The Office points to column 11, lines 21- 
50. The Applicant respectfully submits that Chen does not show or disclose any 
manner by which an additional virus detecting object (i.e. an additional component 
parser) is added. Moreover, Chen does not show or disclose that an additional object 
would comprise instructions for identifying a new file format. Accordingly, the Applicant 
respectfully submits that Chen is deficient to support the rejection of this passage of 
former claim 30, now recited in claim 1 . 

Dependent Claims 6-8 and 13 

[0036] Claims 6-8 and 13 ultimately depend from independent claim 1 . As discussed 
above, claim 1 is not anticipated by the cited document, and is therefore patentable. 
Therefore, claims 6-8 and 13 are also patentable over the cited documents of record for 
at least their dependency from a patentable base claim. These claims may also be 
patentable for the additional features that each recites. 

Independent Claims 14 and 21 

[0037] Claims 14 and 21 recite elements similar to those recited by Claim 1, and are 
allowable for many of the reasons discussed above. These claims have not been 
amended, and therefore retain the same scope as previously presented. 
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Independent Claim 14 

[0038] In particular, claim 14 recites, in part (emphasis added): 

• ' identifying a new file format, wherein ability to recognize the new file 
format is functionality to be extended to a compound parser" 

• "wherein each component parser is configured to recognize a specific 
data file format" 

[0039] The Applicant respectfully submits that Chen does not show or disclose at 
least the above elements, recited by Claim 14, for the reasons discussed above with 
respect to Claim 1. Accordingly, the Applicant respectfully requests allowance of this 
claim, or alternatively, for the Examiner to call so that appropriate amendments may be 
discussed. 

independent Claim 21 

[0040] In particular, claim 21 recites, in part (emphasis added): 

• "wherein each component parser within the compound parser is configured to 
recognize executable code within a specific file format" 

• "sending a don't-know status when the file format of the input file was 
not recognized" 

[0041] The Applicant respectfully submits that Chen does not show or disclose at 
least the above elements, recited by Claim 21, for the reasons discussed above with 
respect to Claim 1 . Accordingly, the Applicant respectfully requests allowance of this 
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claim, or alternatively, for the Examiner to call so that appropriate amendments may be 
discussed. 

Dependent Claims 15-20 and 23-29 

[0042] Claims 15-20 and 23-29 ultimately depend from independent claims 14 and 
21. As discussed above, claims 14 and 21 are not anticipated by the cited document, 
and is therefore patentable over the cited documents. Therefore, claims 15-20 and 23- 
29 are also patentable over the cited documents of record for at least their dependency 
from a patentable base claim. These claims may also be patentable for the additional 
features that each recites. 

Conclusion 

[0043] Applicant respectfully requests reconsideration and prompt issuance of the 
application. If any issues remain that prevent issuance of this application, the Examiner 
is urged to contact the undersigned representative for the Applicant before issuing a 
subsequent Action. 



Respectfully Submitted, 

Lee & Hayes, PLLC 
Representative for Applicant 

/David S. Thompson/ Dated: 20 April 2009 

David S. Thompson 

DavidT@LeeHayes.com 
509-944-4735) 

Registration No. 37,954 
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